On Wed, 2002-01-09 at 01:00, Guy Harris wrote: > > Note that, due to deficiencies in BPF on many BSDs, the "select()" or > "poll()" call would need to have a timeout and, if the timeout expires, > you should do a "pcap_dispatch()" on the "pcap_t". (If you have more > than one "pcap_t" on which you're selecting, when the "select()" returns > you should do a "pcap_dispatch()" on *all* "pcap_t"s.)
I've been trying to find a workaround against this BSD bug in my
project. There is two basic case :
1) listening on several interface
2) listening on one interface.
I used to call the same code path for both, polling my set of descriptor
then calling pcap_loop() with a cnt of 1 when something was available
for reading.
Unfortunaly, it doesn't work on BSD (you get packet by burst because it
is waiting for the buffer to be filled before returning).
I tryed a simple workaround, when there is only one interface to listen
on (most of the case), which is to call pcap_loop() with a cnt of -1.
Someone tested the workaround on FreeBSD 5.0, and it seem we're still
getting burst of packet.
Any idea ?
Ps : we use pcap 0.6.2
--
Yoann Vandoorselaere
http://www.prelude-ids.org
signature.asc
Description: This is a digitally signed message part
